Implying that a values/ethics-based approach is enough or conversely, implying that the rules/compliance-based approach is bad or unnecessary, is irresponsible. Many claim that compliance is “rule based” and “punitive.” Many countries look down their noses at the U.S. for being rule based. These comments almost always come with a negative implication and an implied assertion that a values-based program is more effective or appropriate or enough. A values-based approach is imperative, but the implication that it is better than compliance or will suffice on its own is inappropriate. We need to protect our employees from enforcement penalties, just as we protect them from psychological and physical harm.

Managing an organization without an effective compliance program and relying heavily on a values-based approach can be just as punitive as compliance. Heavy reliance on a values-based approach leaves employees exposed to punitive action. Employees assume that their management is providing a safe environment for them to work in. If you do not audit, monitor, educate, and investigate for potential problems, you are leaving your employees at risk. You are leaving your employees at risk for serious punitive measures from within the organization and from the enforcement community.

There are people in your organization who need your help, and building an ethical culture or espousing ethics and integrity may not be enough. I refer to employees who don’t know they are doing the wrong thing. I would argue that most “fraud” is conducted by people who don’t think they are committing fraud or don’t know that they have gotten too close “to the edge of the law,” because they are receiving little-to-no feedback. These are people who don’t understand the regulation, law, or statute that they are out of compliance with. These are people who assume that the regulatory compliance in their organization is working the way they think it should be working. There are people who have rationalized their behavior as appropriate, but they may be way out of compliance with the law. They need your help, and you can not find them to help them if you just stand at a pulpit espousing virtues, values, and ethical behavior. You are leaving them out in the cold.

There are managers who may understand a regulation but incorrectly assume that the people working for them are following proper procedure. There are people in the trenches who are unaware of important regulations and think they are doing the right thing. I would argue that there are people out there who are going out of their way to do something in an ethical manor but, in fact, are breaking the law. Not all laws are as logical as the people who wrote them had intended. Most laws work as they were intended in most environments. However, that same law may cause you to do something that appears to be unethical in some circumstances. Employees who intend to act in an ethical manner will be inclined to break a law that appears to encourage unethical or inappropriate behavior. This is going to become an enormous problem for employees who work with multiple countries.

Looking down your nose at the “rules-based” or “punitive” nature of compliance programs is irresponsible. You are implying to people that compliance programs are negative or unnecessary. Those who listen to you and interpret the values-based approach as better may think it is enough. Teaching people to be ethical may solve many of your problems. Investigation, auditing, and monitoring will catch things that teaching values can’t catch. Implying that compliance is a negative may result in a reduction in compliance efforts, and that is dangerous. You are leaving your employees at risk.

The government is using a compliance program to find fraud. They are not using a values-based approach to find fraud. You can not attack the U.S. rules-based system of law solely with a values-based approach. You are bringing a knife to a gun fight. The enforcement community is investigating, auditing, monitoring, having a “hotline”, doing risk assessments, etc. To find the biggest problems, they do risk assessments. They practice all of the elements of a compliance program as described in the US Sentencing Guidelines, including education. They come to our conferences and plead with us to find and fix our problems by using effective compliance techniques. It is illogical to imply that you can combat a rules-based enforcement community and combat the government’s use of an effective compliance program simply with vague and general statements of values. You must have an equal or more effective compliance program.

Our business schools are perpetuating this problem by simply teaching ethics. Many don’t even require ethics classes of their business school students. Fewer require adequate compliance training. Most don’t have compliance courses at all. They like ethics because, theoretically, it is a better approach. They are teaching our business school students to take a knife to a gun fight. They are teaching their students to set up systems that leave their employees exposed to punitive risks.

It is popular and more acceptable to push a values-based approach. People seem to enjoy criticizing the rules-based approach of compliance. It is cheaper and more appealing to leadership to teach values and ethics. It is noble. It is more acceptable to all involved. Criticizing rules-based systems is popular. It would be nice if solving our regulatory problems could be that inexpensive and easy. However, implying that it is enough and that compliance is punitive or bad is irresponsible. Employees of your organization are depending on you to protect them from physical and psychological harm. That is obvious. What is not obvious to most people is that your employees are depending on you to protect them from harm and the serious consequences associated with rule breaking.